fix(ci): unmask RE005 exit-masking steps; annotate fail-closed (#942) - #1077

Hypatia RE005 flagged 20 workflow steps across 10 files for silently
swallowing non-zero exit via `|| true` / `continue-on-error: true`. Each
instance was read in context (the step itself plus what runs after it) and
classified as a real mask (A, fixed) or a deliberate fail-closed design
(B, left alone and annotated with an inline `# hypatia: allow` pragma).

1. affinescript-verify.yml "Checkout AffineScript compiler" -- advisory
   annotation added (fails OPEN, not B: best-effort checkout while BLOCKING
   is false; "Verify changed .affine files" surfaces an explicit ::warning::
   instead of a silent green claim).
2. changelog-reusable.yml "Mode = check-only -- verify no drift" -- A:
   removed inert `|| true` (pipe ends in `head -60`; the following `exit 1`
   fails the job either way).
3. ci-pipeline.yml "Checkout the pinned Standards Deno ledger" -- B:
   annotated fail-closed; "Refuse Deno unless this repository is ledgered"
   checks for the ledger file and exits 1 with ::error:: if missing.
4. echidna-verify.yml "Type-check proofs" -- A: rewrote so a real
   `agda --safe` failure is detected (was previously unreachable under
   `tee`'s exit status plus a redundant `|| true`) and surfaced via
   ::warning::, kept advisory since the proof corpus is currently evicted
   (issue #748) and re-entry criteria aren't set.
5-14. governance-reusable.yml (ten instances):
   - "Check banned-language files" -- A: removed inert `|| true` on
     `git ls-files`-terminated captures (RES/GO/SWIFT/DART/VMOD), narrowed
     to `|| [ $? -eq 1 ]` on `grep`-terminated captures (PY/MAKE/JAVA) so a
     real grep error (exit 2) still trips `-e`.
   - "Check for npm/yarn artifacts" -- A: removed 4 inert `|| true`
     (`git ls-files`/`find`-terminated).
   - "Security checks" -- A: removed 3 inert `|| true` (`head`-terminated).
   - "Check file permissions" / "Check TODO/FIXME" / "Check for large
     files" -- A: dropped `continue-on-error: true` entirely (each step
     already always exits 0) and now emit an explicit ::warning:: instead
     of a silent printout.
   - "EditorConfig check" -- advisory annotation added (fails OPEN, not B:
     a follow-up step surfaces ::warning:: on failure; repos opt into
     blocking locally).
   - "Mixed content check" -- A: removed inert `|| true` (`head`-terminated).
   - "Checkout the pinned Standards policy helpers" -- B: annotated
     fail-closed; "Duplicate YAML keys in workflows" refuses to run
     (::error:: + exit 1) when neither script copy is present.
   - "Check locked or SHA-pinned actions" -- A: narrowed `|| true` to
     `|| [ $? -eq 1 ]` (`grep -cve`-terminated; an empty ledger file is an
     expected, not error, case).
15. hypatia-scan-reusable.yml "Check out standards for the SARIF baseline
    filter" -- advisory annotation added (fails OPEN, not B: the fallback
    uploads the SARIF unfiltered, which can only show more alerts).
16. readme-derive-reusable.yml "Freshness check (fail-and-tell)" -- A:
    narrowed `|| true` to `|| [ $? -eq 1 ]` on a bare `diff` display
    command; the following regen instructions + `exit 1` still fire.
17. scorecard-enforcer.yml "Check for pinned dependencies" -- A: removed
    inert `|| true` (`head`-terminated; already emits ::warning:: itself).
18-19. secret-scanner-reusable.yml "Check for hardcoded secrets in Rust" /
   "... in shell scripts" -- A: narrowed `grep`-terminated captures to
   `|| [ $? -eq 1 ]`, removed one inert `sed -n`-terminated `|| true`.
20. security-gate-pr-target.yml "Extract PR branch for safe checkout" -- A:
    the most severe finding. Removed the same-named-base-repo-branch
    fallback (which could let a malicious fork PR's real content go
    unscanned while reporting success) and converted silent tolerance of
    fetch/checkout failure into explicit ::error:: + exit 1.

Validation: `ruby -ryaml -e 'YAML.load_file(...)'` and `yq .` both pass
cleanly on all 10 files. `actionlint` exits 1 but every finding (shellcheck
info/style/warning notes and pre-existing `job.workflow_sha` property
errors) is confirmed pre-existing and unrelated to these edits -- zero new
findings introduced.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFphKkDVB9pUDSCD4bkz65